Causal model
What has to happen for this consequence to hold?
2 candidate paths · explicit source, inference, and assumption boundaries.
Safety · Co-dominant path
Device-control safety
The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.
Proximity or local access
The attacker needs optical line of sight from a nearby projector or digital billboard to the vehicle camera.
EvidenceNo direct citation — inspect the declared inference or assumption.
Cross-domain authority chain
The projected image crosses from the roadside environment into the vehicle camera and then into automatic braking.
EvidenceNo direct citation — inspect the declared inference or assumption.
Severe therapy or actuation consequence
The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.
EvidenceNo direct citation — inspect the declared inference or assumption.
Device-control safety
The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
Mitigation requires perception hardening and operational controls because no single firmware change removes every physical-world ambiguity.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 2 - Proximity or local access
The attacker needs optical line of sight from a nearby projector or digital billboard to the vehicle camera.
- Execution complexity
EC 4 - Straightforward operation
The demonstrated attack places and times a phantom image with a commodity projector or digital billboard; it does not require vehicle code execution.
- Exposure
EX 2 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 4 - Severe therapy or actuation consequence
The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.
- Data / perception
DP 4 - Safety-driving perception or intimate data
The projected object corrupts the camera-derived road model that Autopilot uses to decide when to brake.
- Authority
AT 2 - Bounded function authority
Authority is indirect: the attacker does not gain privilege but coerces the vehicle's own control output via spoofed input — (influence over a bounded actuation, no signing and firmware and fleet-control root).
Scale and recovery
- Chainability
CH 4 - Cross-domain authority chain
The projected image crosses from the roadside environment into the vehicle camera and then into automatic braking.
- Reuse scale
SR 4 - Shared fleet-wide primitive
Shared model-level perceptual weakness, fully portable.
- Execution scale
SX 3 - Deployment-wide with setup
One phantom source affects all passing affected vehicles but needs per-location optical placement.
- Recovery burden
OR 3 - Coordinated operational recovery
Mitigation requires perception hardening and operational controls because no single firmware change removes every physical-world ambiguity.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Mitigated - Vendor mitigation is recorded
The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. The demonstrated phantom object caused sudden automatic braking on a live road, creating credible rear-end collision or evasive-maneuver risk.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATEDRead the scoring method →Perception · Co-dominant path
Perception-to-action
Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.
Proximity or local access
Optical line-of-sight (projector and billboard within camera view) is proximity and local-physical-world positioning, not network —.
EvidenceNo direct citation — inspect the declared inference or assumption.
Cross-domain authority chain
As a reusable cross-domain bridge from environment manipulation to vehicle control.
EvidenceNo direct citation — inspect the declared inference or assumption.
Safety-driving perception or intimate data
Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.
EvidenceNo direct citation — inspect the declared inference or assumption.
Perception-to-action
Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
No clean firmware patch removes the ambiguity.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 2 - Proximity or local access
Optical line-of-sight (projector and billboard within camera view) is proximity and local-physical-world positioning, not network —.
- Execution complexity
EC 4 - Straightforward operation
Once optical line of sight is established, a consumer projector or millisecond-long billboard image can create the demonstrated phantom object.
- Exposure
EX 2 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 4 - Severe therapy or actuation consequence
A convincing phantom object can make the vehicle brake suddenly on a live road; the physical risk follows from the ADAS response to corrupted perception.
- Data / perception
DP 4 - Safety-driving perception or intimate data
Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.
- Authority
AT 2 - Bounded function authority
The projected image influences the perception pipeline but does not grant software, administrator, or vehicle-control authority.
Scale and recovery
- Chainability
CH 4 - Cross-domain authority chain
As a reusable cross-domain bridge from environment manipulation to vehicle control.
- Reuse scale
SR 4 - Shared fleet-wide primitive
The perceptual ambiguity is shared across every vehicle of the affected model and software, fully portable, no per-vehicle secret.
- Execution scale
SX 3 - Deployment-wide with setup
One billboard and projector hits many passing vehicles but requires per-site optical setup and line-of-sight, deployment-wide rather than fully fleet-remote and cloud.
- Recovery burden
OR 3 - Coordinated operational recovery
No clean firmware patch removes the ambiguity.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
source citation pending public URL supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Mitigated - Vendor mitigation is recorded
The record treats the path as mitigated; the historical mechanism remains useful for review and regression analysis.
Decision trail
How the final band follows
- Base bandCRITICAL
- No adjustment
The CRITICAL base band remains final because no separate cap or systemic uplift applies. Projected or billboard phantom objects corrupt the camera-based world model, and the automated driving stack acts directly on the false object.
- Final candidate bandCRITICAL
Technical vector
CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATEDRead the scoring method →Triage implication
Verify the safety transition before acting on the band.
Validate the deployment-specific transition from digital control or perception to physical action before setting remediation urgency.
Evidence ledger
Public sources used by this record.
At least one citation still lacks a public URL; that gap keeps this record provisional.
- othersource citation pending public URL
source citation pending public URL · public URL pending
Published baseline
Keep exploit severity and consequence reasoning distinct.
No public baseline score is available for this case.
Original scorer notes
The source narrative behind the structured explanation.
Retained for provenance and historical review, not as the recommended way to understand the assessment.
Read the original scorer notes
Assessment
CFSE Consequence Paths assesses Phantom of the ADAS: Projected/Billboard Phantom Object Attacks on Tesla Autopilot and Mobileye at CRITICAL — the worst of 2 risk paths (safety, perception). The dominant consequence is influence over a safety-relevant actuation.
Vulnerability
Phantom of the ADAS: Projected/Billboard Phantom Object Attacks on Tesla Autopilot and Mobileye. Reported attack vector: Physical/optical line-of-sight (projector or compromised/leased digital billboard within camera view).
CFSE Consequence Paths analysis
The vulnerability is decomposed into one risk path per terminal consequence. Each path is scored on its exposure (reachability × execution complexity) and the authority, perception, and physical/safety it reaches, together with its scale of reuse, scale of execution, and recoverability.
DEVICE_CONTROL_SAFETY → CRITICAL
CPATH:1.0-candidate/TT:DEVICE_CONTROL_SAFETY/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATED
Exposure EX=2 (reachability-bound) · bands PH=CRITICAL · DP=CRITICAL · AT=ELEVATED → base CRITICAL → assessed CRITICAL.
Same positioning and execution as the perception path: proximity optical line-of-sight RE:2, trivial commodity projector/billboard EC:4. Terminal consequence here is the actuation itself — sudden unwarranted automatic braking on a live road, demonstrated on Tesla Model X HW2.5/HW3, with credible potential for rear-end collision or dangerous evasive maneuver — PH:4 (dangerous actuation / credible injury). DP:4 because the trigger is corruption of the safety-relevant camera world model, perception_feeds_action=true. Authority is indirect: the attacker does not gain privilege but coerces the vehicle’s own control output via spoofed input — AT:2 (influence over a bounded actuation, no signing/firmware/fleet-control root). Crosses optical/perception/actuation/safety boundaries — boundary_crossing=true, CH:4 reusable bridge. SR:4 shared model-level perceptual weakness, fully portable. SX:3 one phantom source affects all passing affected vehicles but needs per-location optical placement. OR:3 no single firmware fix; addressed via perception-model improvements, no recall/fleet reprovision required. EV:3 reproduced on production vehicles; LS MITIGATED; no in-the-wild exploitation.
PERCEPTION_TO_ACTION → CRITICAL
CPATH:1.0-candidate/TT:PERCEPTION_TO_ACTION/RE:2/EC:4/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:3/EV:3/LS:MITIGATED
Exposure EX=2 (reachability-bound) · bands PH=CRITICAL · DP=CRITICAL · AT=ELEVATED → base CRITICAL → assessed CRITICAL.
Optical line-of-sight (projector/billboard within camera view) is proximity/local-physical-world positioning, not network — RE:2. Once positioned, attack is trivial single-projection/commodity (consumer projector, ms-long billboard frame), minimal expertise — EC:4. The phantom corrupts the camera-based world model / object-detection input, the safety-relevant perception layer — DP:4, perception_feeds_action=true because the spoofed object directly drives autonomous braking/steering decisions. No software privilege gained; attacker abuses the legitimate perception-to-actuation pathway, inducing the ADAS to take its own bounded safety action — AT:2. Crosses physical/optical -> perception -> actuation/safety boundaries — boundary_crossing=true, CH:4 as a reusable cross-domain bridge from environment manipulation to vehicle control. SR:4: the perceptual ambiguity is shared across every vehicle of the affected model/software, fully portable, no per-vehicle secret. SX:3: one billboard/projector hits many passing vehicles but requires per-site optical setup and line-of-sight, deployment-wide rather than fully fleet-remote/cloud. OR:3: no clean firmware patch removes the ambiguity; mitigated via multi-network authenticity model improvements (GhostBusters) rather than a single fix or fleet reprovision. EV:3 reproduced on production Tesla Model X and Mobileye 630 PRO; LS MITIGATED; not known exploited in wild.
Published baseline
No public baseline score has been published for this finding. It belongs to a design-level harm class that is often outside published vulnerability-scoring coverage. The registry records the reachable consequence path for review.
Sources
- source citation pending public URL
CFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0021 (“Phantom of the ADAS: Projected/Billboard Phantom Object Attacks on Tesla Autopilot and Mobileye”), paths.cfse.ai/CPATH-2026-0021 (published 2026-06-03).